qa-cli-mcp-api

A risk-based testing guide for a command-line tool, webhooks, a local MCP connection, a hosted API, and a remote MCP connection. MCP is a way for applications to expose tools that an agent can call.

In plain words
What is it for?
Use it to test command parsing and output, webhook signing and retries, MCP communication, API behavior, or targeted regressions after a code change.
Why use it?
It helps choose tests that match the changed part of the system, so small changes do not require unrelated testing. It also identifies when a real client or deployed service needs a live check.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/fastrepl/anarlog/qa-cli-mcp-api
Any agent
npx skills add fastrepl/anarlog --skill qa-cli-mcp-api
Clone the repo
git clone --depth 1 https://github.com/fastrepl/anarlog

Made for: Claude Code, Codex.

Per session 47 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,820 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00047 $0.02820
Opus 5 $0.00023 $0.01410
Sonnet 5 $0.00009 $0.00564
Haiku 4.5 $0.00005 $0.00282

Measured 2d ago against content hash 04f5612d71e4, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

qa-cli-mcp-api scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/qa-cli-mcp-api/SKILL.md · 281 lines

How it starts

The opening of the file, as written. The whole thing — 281 lines — stays where its author put it; the contents beside it link to each section on GitHub.

QA: CLI, MCP, and API

Default to the smallest set of programmatic-interface lanes that can prove the change. Automated tests are necessary but do not replace a live smoke test when the changed boundary is only exercised by a real client or deployment.

This QA workflow is independent from releasing. A release request alone does not invoke it, and its results do not approve or block a release.

Choose the scope first

Inspect the exact branch, commit, or diff and map changed code to its direct consumers before creating fixtures or credentials. In a GitButler workspace, use but status and but show <commit-or-branch>; do not use the synthetic workspace HEAD as the candidate or combine unrelated applied branches.

Find the original reproduction in the current or past Codex task, linked issue, PR, support report, or regression test. State the selected lanes and the reason for each before testing.

Targeted regression mode (default)

Select lanes by behavior, not by the existence of this checklist:

  • CLI parsing, output, or local DB access → CLI plus the closest contract tests.
  • Webhook endpoints, signing, or delivery retries → the webhook cases only.
  • Shared agent-access DTOs, exports, filtering, or pagination → every direct consumer, including hosted REST or remote MCP when affected, plus cross-surface parity only for the changed fields.
  • Hosted auth, snapshots, entitlements, isolation, purge, or Supabase policy → the affected hosted REST lifecycle and negative cases.
  • Local or remote MCP protocol/tool changes → that MCP lane and its direct transport/contract dependency.
  • Shared hosted REST/MCP behavior → both hosted consumers, but not unrelated local surfaces.

Run the closest affected automated tests, the original live reproduction, and only credible boundary cases. A Rust or shared-crate change does not trigger all lanes unless every lane consumes the changed behavior. Create only the minimum non-sensitive fixture required for the selected checks. If a required deployment, account, fixture, or client is unavailable, mark that check BLOCKED; do not substitute unrelated lanes. Stop when the mapped risks are covered.

Read the full file on GitHub · 281 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 281 lines · 47 tokens per session scan A 04f5612d71e4

Subscribe to this mod's changes

qa-cli-mcp-api is a skill published in the GitHub repository fastrepl/anarlog (9,219 stars, last pushed today), licensed MIT. It adds 47 tokens to every session and 2,820 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

shellx-host

ShellX host-session manifest. Use only when the current prompt or runtime metadata positively identifies this session as running inside ShellX, when ShellX host tools are advertised, or when the user explicitly asks about ShellX host APIs or surfaces. Do not use merely because this skill is installed, a project…

martinsbrezauckis/shellx · 89 tokens

design-language

Use when building, modifying, or fixing any frontend UI in the Asyar launcher — new components, new views, layout changes, styling decisions, new built-in features, visual bug fixes, and anything in settings or onboarding. Answers "what do I use here?" for fonts, colour, typography, spacing, motion, components, and…

Xoshbin/asyar · 72 tokens

architectural-integrity

Use before planning or implementing ANY feature, bug fix, refactor, or API change that touches Asyar's architecture — extension system, service layer, IPC contracts, Tauri commands, manifest contributions, or cross-layer data flow. Triggers on new features, new extension APIs, new services, bug fixes involving…

Xoshbin/asyar · 176 tokens

generated-files

Never hand-edit or hand-copy generated content. Use when touching permissions.rs, error.rs, AppError/SearchError variants, runtimes/catalog.fallback.json, any #[derive(specta::Type)] struct, any file with an AUTO-GENERATED banner (kinds.ts, gatedPermissions.ts, knownRuntimes.ts, bindings.ts, emoji data), or whenever…

Xoshbin/asyar · 95 tokens

dev-environment

Reference for the Asyar monorepo structure, SDK workspace linking, lockfile discipline, CI workflows, and release flow. Use this skill whenever working on anything related to pnpm workspace setup, the asyar-sdk dependency, lockfile errors, SDK or launcher version bumps, CI configuration, release workflow, or questions…

Xoshbin/asyar · 113 tokens

review-ipc

Audit IPC message contracts between extensions and the Asyar host. Use when adding a new SDK service, adding a new proxy method, changing a postMessage type string, or reviewing permission gate coverage.

Xoshbin/asyar · 43 tokens